CISA Flags 6 Vulnerabilities - Apple, Apache, Adobe, D

D-Link DSL-2750B routers running firmware before 1.05 contain an unauthenticated command injection flaw (CWE-77) in the 'cli' parameter of the login.cgi web endpoint. An attacker can trigger it remotely by sending a crafted HTTP request to login.cgi with shell metacharacters embedded in the cli parameter, requiring no credentials or user interaction. Successful exploitation yields arbitrary command execution on the router, giving the attacker full control of the device, which can be used for traffic interception, persistence, or recruitment into botnets such as the Mirai-based IZ1H9 campaign noted in recent reporting. Any internet-facing DSL-2750B running affected firmware is exposed, and CISA added the issue to the Known Exploited Vulnerabilities catalog on 2024-01-08 after exploitation observed in the wild from 2016 through 2022. With a CVSS of 9.8 and an EPSS of ~65%, exploitation pressure on unpatched devices remains high.

Do: Upgrade DSL-2750B firmware to version 1.05 or later per vendor instructions; if an update is unavailable or the device is end-of-life, follow CISA's required action and discontinue use or restrict web (HTTP) management access to trusted networks only. Defenders should check device logs for suspicious unauthenticated requests to login.cgi containing shell metacharacters in the cli parameter, as these indicate exploitation attempts.

Joomla! contains an improper access control flaw (CWE-284) in its webservice (REST API) endpoints: the API fails to enforce authentication, so unauthenticated remote attackers can access protected endpoints directly. It is triggered simply by sending crafted HTTP requests to the affected /api webservice routes without credentials, for example the route that exposes site application configuration. A successful request leaks sensitive configuration data, most notably database connection credentials, which attackers can use for further intrusion into the site's database and hosting environment. Any site running the affected Joomla! 4.x releases whose webservice endpoints are reachable is affected. Exploitation is confirmed in the wild — the flaw was added to CISA's KEV catalog on 2024-01-08 and carries a 99.8% EPSS probability of exploitation within 30 days — though no public proof-of-concept is known and ransomware use has not been confirmed.

Do: Upgrade all Joomla! 4.x sites to 4.2.8 or later per the vendor's instructions, satisfying the CISA KEV required action. If upgrading is not immediately possible, restrict or block unauthenticated access to the /api/index.php webservice routes at the web server or WAF, treat any exposed database credentials as compromised (rotate them), and review logs for unauthenticated requests to /api endpoints. Organizations that cannot mitigate should discontinue use of the affected product per the CISA required action.

Apache Superset versions up to and including 2.0.1 ship with a known, hard-coded default SECRET_KEY that signs all session cookies and encrypts sensitive data in the database. Installations that never changed this default value, contrary to the vendor's installation instructions, can be attacked over the network with no privileges or user interaction, because anyone who knows the public default key can forge valid, authenticated session cookies. By forging an administrator's session cookie, an attacker gains unauthorized access to Superset resources, and public proofs of concept demonstrate chaining this authentication bypass to remote code execution. Only deployments still using the default SECRET_KEY are affected; administrators who set a unique, strong key per the vendor instructions are not impacted. Exploitation is confirmed in the wild: CISA added the issue to the Known Exploited Vulnerabilities catalog on 2024-01-08, EPSS estimates a 97.4% probability of exploitation within 30 days, and public scans show thousands of exposed servers.

Do: Upgrade Superset beyond 2.0.1 to a patched release (fixed in 2.1.0) and, critically, set a unique, strong random SECRET_KEY in superset_config.py or via the SUPERSET_SECRET_KEY environment variable on every deployment, since upgrading alone does not help if the well-known default key remains in use. If the default key was ever used, rotate it, invalidate existing sessions, and review affected servers—especially internet-exposed ones—for unauthorized access or code execution. Per CISA KEV, apply mitigations per vendor instructions or discontinue use of affected installations.

Adobe ColdFusion contains a deserialization of untrusted data flaw (CWE-502): the application deserializes attacker-supplied, untrusted serialized data without adequate validation, allowing an attacker to trigger code execution on the ColdFusion server. Successful exploitation yields arbitrary code execution in the context of the running ColdFusion server, a foothold that can be leveraged for further compromise and, per CISA, ransomware deployment. Any organization running Adobe ColdFusion is affected, especially internet-facing instances; the CISA data does not enumerate specific affected version ranges, so operators should consult Adobe's advisory for the exact affected and fixed releases. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-08 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days (100th percentile); no public PoC is known, but the KEV listing and ransomware usage confirm active in-the-wild exploitation.

Do: Patch every ColdFusion instance with the updates from Adobe's security advisory (APSB23-52), which satisfies the CISA required action to apply vendor mitigations or discontinue use of the product if mitigations are unavailable; prioritize internet-facing servers. If patching must be delayed, restrict network access to the ColdFusion server per vendor guidance and review logs for signs of exploitation or ransomware activity.

CVE-2023-38203 is a critical (CVSS 9.8) deserialization-of-untrusted-data flaw (CWE-502) in Adobe ColdFusion that can lead to arbitrary code execution. It is triggered over the network when an affected ColdFusion server processes crafted untrusted serialized data, and exploitation requires no authentication and no user interaction. A successful attacker gains arbitrary code execution with high impact on confidentiality, integrity, and availability of the host. Organizations running ColdFusion 2018 (Update 17 or earlier), ColdFusion 2021 (Update 7 or earlier), or ColdFusion 2023 (Update 1 or earlier) are affected. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-01-08 with known ransomware use, EPSS assigns a 96.7% probability of exploitation within 30 days (100th percentile), and Adobe has shipped out-of-band patches in response.

Do: Upgrade all ColdFusion 2018, 2021, and 2023 installations beyond the affected levels (at least past 2018u17, 2021u7, and 2023u1, using the latest update Adobe provides in its advisory). If patching must be delayed, apply the mitigations per Adobe's instructions, restrict or remove internet exposure of ColdFusion servers, and prioritize internet-facing hosts. Because exploitation is confirmed with known ransomware use, review ColdFusion logs and affected hosts for signs of exploitation, webshells, or follow-on malware, and discontinue use of the product if mitigations are unavailable per CISA's required action.

CVE-2023-41990 is a vulnerability in Apple's font processing, addressed via improved handling of caches, in which processing a maliciously crafted font file can lead to arbitrary code execution on the device. It is triggered when an application on the device processes an attacker-supplied font, and the CVSS local/user-interaction vector indicates the target user must be involved (e.g., viewing content that includes the malicious font). A successful exploit gives the attacker arbitrary code execution with high impact on confidentiality, integrity, and availability, and it was used as a component of the sophisticated multi-zero-day Operation Triangulation iPhone attack chain described in recent research. All users of Apple iPhones, iPads, Macs, Apple TVs, and Apple Watches running versions older than the listed fixed releases are affected; Apple stated the issue was actively exploited against versions of iOS released before iOS 15.7.1. Exploitation is confirmed in the wild: CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2024-01-08 (EPSS ~1.3%), and no public proof-of-concept is required given the documented active use.

Do: Upgrade affected devices to iOS/iPadOS 16.3 (or iOS/iPadOS 15.7.8 for devices remaining on the 15.x line), macOS Ventura 13.2, macOS Monterey 12.6.8, or macOS Big Sur 11.7.9, plus tvOS 16.3 and watchOS 9.3; this is mandatory for U.S. federal agencies per the 2024-01-08 CISA KEV listing. Given the bug's role in the Operation Triangulation campaign, prioritize Apple fleet-wide patching and hunt for indicators of compromise from that campaign on devices that had been running pre-patch versions.